The SonicWall Capture Labs Threat Research Team has conducted an experimental dialog similar to our previous PayDay ransomware SonicAlert. This time we look at a ransomware threat known as Genasom where the operators use email to communicate and negotiate payment with their victims. In this case the operator wanted direct access to the infected machine in order to "fix" the problem after which a small donation is requested (according to them).

For specific informartion, please send us an email with Your ID number:

serverup@keemail.me

serverup@protonmail.com

serverup1@yandex.com

serverup3@yandex.com

ann.c@iname.com

Please send email to all email addresses! We will help You as soon as possible!

DECRYPT-ID-6f179b9f-7506-4075-beea-5791809b6c04 number

IMPORTANT: DO NOT USE ANY PUBLIC SOFTWARE! IT MAY DAMAGE YOUR DATA FOREVER!

From here the victim is left with no choice but to contact the operators via email. The following, is a short conversation we had with the operator:

We do not know what is behind this 'good will' scheme but would advise infected users to never take the bait. The operator will most likely cause more harm than good once granted access. This could range installing further malware and snooping on other machines within the network to launching DDoS attacks from the infected machine.

Sounds too good to be true and probably is.

SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures: